How could I know if there's a keylogger in my system, or at least if one is active right now?
Is a keylogger running right now?
Did I accidentally download a trojan/virus keylogger?
What if I'm on an "untrusted" Ubuntu system?
So what if you're in an internet/cybercafe, at the library, at work, etc.? Or even a home computer used by many family members?
Well, all bets are off in that case. It's fairly easy to spy on your keystrokes if someone has enough skill/money/determination:
So, the best you can do with an untrusted system is to take your own Live-CD/Live-USB and use that, take your own wireless keyboard and plug it into a usb port other than the one the system's own keyboard is on (eliminating hardware loggers both hidden in the keyboard, and ones on that port hidden in the computer, in hopes they didn't use a hardware logger for each port on the entire system), learn to spot cameras (including likely spots for hidden ones), and if you're in a police state, finish what you're doing and be somewhere else in less time than the response time of the local police.
Yes, Ubuntu can have a key-logger. Its far fetched, but it can happen. It can be exploited via a browser and an attacker can run code with your user privileges. It can use auto-start services which run programs on login. Any program can get scan codes of pressed keys in X Window System. It is easily demonstrated with
linux key loggers needs to have a root access before they can monitor the keyboard. unless they don't gain that privilege they can't run a key logger. The only thing that you can do is check for rootkits. To do that you can use CHKROOTKIT
I just want to throw in something that I did not know existed on Linux: Secure Text Input.
On xterm, cntrl+click -> "Secure Keyboard". This makes a request to isolate xterm keystrokes from other x11 apps. This doesn't prevent kernel loggers, but is just one level of protection.
Linux keyloggers can be made from languages that are compatible with the system and would require the use of local file storage to record this data and, if programmed to do so, if you do have a keylogger that was manually programmed or downloaded to work with this operating system then it may actually be a file, possibly renamed to look like a system file, anywhere on the system.
Last time I created/had a keylogger on my system this was the situation and it was easy to detect and remove but it included manually finding the source and this took a little time.
If you do have a keylogger of this type, I'd attempt to find and remove it but if it is indeed something that was downloaded or installed I'd consider this highly unlikely as Linux is a secure operating system that is usually not suspect to forms of viruses you would normally find on Windows systems.
protected by Eric Carvalho Aug 21 at 12:11
Thank you for your interest in this question.
Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.
Would you like to answer one of these unanswered questions instead?